Fix everything.

system/services/server/socialserver/default.nix

@@ -0,0 +1,10 @@
+{ lib, ... }:
+{
+  options.system.socialserver.enable = lib.mkEnableOption "Enable social media like services";
+
+  imports = [
+    ./mastodon
+    ./matrix
+    ./owncast
+  ];
+}

system/services/server/socialserver/mastodon/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, pkgs, ... }:
+{
+  config = lib.mkIf config.system.socialserver.enable {
+    services.mastodon = {
+      enable = true;
+      localDomain = "social.nixfox.ca";
+      streamingProcesses = 4;
+      configureNginx = true;
+      smtp = {
+        createLocally = false;
+        host = "mx.nixfox.ca";
+        port = 587;
+        authenticate = true;
+        fromAddress = "NixFox Mastodon <noreply@nixfox.ca>";
+        user = "noreply@nixfox.ca";
+        passwordFile = pkgs.writeText "smtp_pass.txt" config.secrets.noreplyPassword;
+      };
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/mastodon"
+    ];
+  };
+}

system/services/server/socialserver/matrix/coturn/default.nix

@@ -0,0 +1,46 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    services = {
+      coturn = {
+        enable = true;
+        no-cli = true;
+        no-tcp-relay = true;
+        min-port = 49000;
+        max-port = 50000;
+        use-auth-secret = true;
+        static-auth-secret = config.secrets.coturnSecret;
+        realm = "turn.jimbosfiles.com";
+        cert = "/var/lib/acme/turn.jimbosfiles.com/fullchain.pem";
+        pkey = "/var/lib/acme/turn.jimbosfiles.com/key.pem";
+      };
+
+      # Enable coturn on Synapse
+      matrix-synapse.settings = {
+        turn_uris = [
+          "turn:turn.jimbosfiles.com:3478?transport=udp"
+          "turn:turn.jimbosfiles.com:3478?transport=tcp"
+        ];
+        turn_shared_secret = config.secrets.coturnSecret;
+        turn_user_lifetime = "1h";
+      };
+
+      # Sync the IP to Cloudflare
+      cloudflare-dyndns.domains = [ "turn.jimbosfiles.com" ];
+    };
+
+    # Open coturn ports
+    networking.firewall = {
+      allowedUDPPorts = [
+        3478
+        5349
+      ];
+      allowedUDPPortRanges = [{
+        from = config.services.coturn.min-port;
+        to = config.services.coturn.max-port;
+      }];
+    };
+  };
+}

system/services/server/socialserver/matrix/coturn/nginx/default.nix

@@ -0,0 +1,22 @@
+{ config, lib, ... }:
+{
+  config = lib.mkIf config.services.coturn.enable {
+    services.nginx.virtualHosts."turn.jimbosfiles.com" = {
+      enableACME = true;
+      forceSSL = true;
+      listen = [{
+        addr = "0.0.0.0";
+        port = 80;
+        ssl = false; 
+      }];
+      locations."/".proxyPass = "http://127.0.0.1:1380";
+    };
+
+    security.acme.certs = {       
+      "turn.jimbosfiles.com" = {
+        group = "turnserver";
+        postRun = "systemctl restart coturn.service";
+      };
+    };
+  };
+}

system/services/server/socialserver/matrix/default.nix

@@ -0,0 +1,8 @@
+{ ... }:
+{
+  imports = [
+    ./coturn
+    ./element
+    ./synapse
+  ];
+}

system/services/server/socialserver/matrix/element/default.nix

@@ -0,0 +1,23 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.services.matrix-synapse.enable {
+    nixpkgs.config.element-web.conf = {
+      default_server_config."m.homeserver" = {
+        base_url = "https://matrix.jimbosfiles.com";
+        server_name = "matrix.jimbosfiles.com";
+      };
+      branding = {
+        #welcome_background_url = "https://staging.jimbosfiles.com/images/backgrounds/template-background.png";
+        #auth_header_logo_url = "https://staging.jimbosfiles.com/images/logos/template-logo.png";
+      };
+      embedded_pages = {
+        home_url = "https://www.jimbosfiles.com/";
+      };
+      disable_custom_urls = true;
+      disable_guests = true;
+      default_theme = "dark";
+    };
+  };
+}

system/services/server/socialserver/matrix/element/nginx/default.nix

@@ -0,0 +1,8 @@
+{ config, lib, pkgs, ... }:
+{
+  services.nginx.virtualHosts."chat.nixfox.ca" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    addSSL = true;
+    root = "${pkgs.element-web}";
+  };
+}

system/services/server/socialserver/matrix/synapse/default.nix

@@ -0,0 +1,62 @@
+{ config, lib, pkgs, ... }:
+{
+  imports = [
+    ./nginx
+  ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.matrix-synapse = {
+      enable = true;
+      settings = {
+        server_name = "jimbosfiles.com";
+        public_baseurl = "https://matrix.jimbosfiles.com";
+        suppress_key_server_warning = true;
+
+        listeners = [{
+          port = 8008;
+          bind_addresses = [
+            "::"
+            "0.0.0.0"
+          ];
+          resources = [{
+            compress = true;
+            names = [
+              "client"
+              "federation"
+            ];
+          }];
+          type = "http";
+          tls = false;
+          x_forwarded = true;
+        }];
+
+        email = {
+          notif_from = "NixFox Matrix <noreply@nixfox.ca>";
+          smtp_host = "mx.nixfox.ca";
+          smtp_user = "noreply@nixfox.ca";
+          smtp_pass = config.secrets.noreplyPassword;
+          enable_tls = true;
+          smtp_port = 587;
+          require_transport_security = true;
+        };
+
+        # Disable registration without email
+        registrations_require_3pid = [ "email" ];
+
+        # Set the type of database
+        database.name = "sqlite3";
+
+        # Allow account registration
+        #enable_registration = true;
+
+        # General settings
+        url_preview_enabled = true;
+        max_upload_size = "50M";
+        report_stats = false;
+        burst_count = 15;
+      };
+    };
+
+    environment.persistence."/persist".directories = [ "/var/lib/matrix-synapse" ];
+  };
+}

system/services/server/socialserver/matrix/synapse/nginx/default.nix

@@ -0,0 +1,13 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."matrix.jimbosfiles.com" = lib.mkIf config.services.matrix-synapse.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations = {
+      "/".extraConfig = ''return 403;'';
+      "/client".proxyPass = "http://127.0.0.1:8008";
+      "/_matrix".proxyPass = "http://127.0.0.1:8008";
+      "/_synapse/client".proxyPass = "http://127.0.0.1:8008";
+    };
+  };
+}

system/services/server/socialserver/owncast/default.nix

@@ -0,0 +1,16 @@
+{ config, lib, ... }:
+{
+  imports = [ ./nginx ];
+
+  config = lib.mkIf config.system.socialserver.enable {
+    services.owncast = {
+      enable = true;
+      port = 8060;
+      rtmp-port = 1945;
+      listen = "0.0.0.0";
+    };
+    environment.persistence."/persist".directories = [
+      "/var/lib/owncast"
+    ];
+  };
+}

system/services/server/socialserver/owncast/nginx/default.nix

@@ -0,0 +1,11 @@
+{ config, lib, ... }:
+{
+  services.nginx.virtualHosts."live.nixfox.ca" = lib.mkIf config.services.owncast.enable {
+    enableACME = true;
+    forceSSL = true;
+    locations."/" = {
+      proxyPass = "http://127.0.0.1:8060";
+      proxyWebsockets = true;
+    };
+  };
+}